Splunk Search

How to create a search based on a conditional dashboard token value?

rubyboomslang
New Member

Psuedocode:

If dashboard token is empty, run X search.
If token is not empty, run Y search.

if($field$ is omitted)
  search index=index1 (other conditions)
else
  search index=index1 field2=$field$)

How do I write this as a Splunk search?

0 Karma

horsefez
Motivator

Hi,

could this help you any further?

      <input type="dropdown" token="xyz_application">
        <label>XYZ_Application</label>
        <default>Splunk</default>
        <fieldForLabel>Application</fieldForLabel>
        <fieldForValue>xyz_application</fieldForValue>
        <search>
          <query>index=someindex | dedup xyz_application | sort xyz_application</query>
          <earliest>-60d</earliest>
          <latest>now</latest>
        </search>
      </input>

This searches for "Splunk" as default application or something else, when you specify another one.
You can then simply transfer this token into another panel search or so.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...